Lesson 8 Implementing IAM controls Flashcards
Public key infrastructure (PKI)
Public key infrastructure (PKI) allows the management of digital identities
certificate authority (CA
certificate authority (CA) issues certificates to validated subjects (users and servers).
The identity provider (IdP)
The identity provider (IdP) is the service that provisions the user account and processes authentication requests
privilege access management (PAM)
privilege access management (PAM) products provide a solution for storing these high-risk credentials somewhere other than a spreadsheet and for auditing elevated privileges
Privileged access management (PAM) refers to policies, procedures, and technical controls to prevent the malicious abuse of privileged accounts and to mitigate risks from weak configuration control over privileges.
Discretionary access control (DAC)
Discretionary access control (DAC) is based on the primacy of the resource owner. The owner is originally the creator of a file or service, though ownership can be assigned to another user
Role-based access control (RBAC)
Role-based access control (RBAC) adds an extra degree of centralized control to the DAC model. Under RBAC, a set of organizational roles are defined, and subjects are allocated to those roles.
Under this system, the right to modify roles is reserved to a system owner. Therefore, the system is non-discretionary, as each subject account has no right to modify the ACL of a resource, even though they may be able to change the resource in other ways
Mandatory access control (MAC)
Mandatory access control (MAC) is based on the idea of security clearance levels. Rather than defining ACLs on resources, each object and each subject is granted a clearance level, referred to as a label.
Attribute-based access control (ABAC)
Attribute-based access control (ABAC) is the most fine-grained type of access control model.
ABAC system is capable of making access decisions based on a combination of subject and object attributes plus any context-sensitive or system-wide attributes.
- Time of day
- IP
- Location
Rule-based access control
Rule-based access control - any sort of access control model where access control policies are determined by system-enforced rules rather than system users.
As such, RBAC, ABAC, and MAC are all examples of rule-based (or non- discretionary) access control.
Federation
Federation is the notion that a network needs to be accessible to more than just a well-defined group of employees.
- Trusting accounts created and managed by other networks
- SAML (Security Assertions Markup Language)-Openstandard for implementing identity
- Obtaining assertion (access) from an identy provider.
- Corporate
- User centric
Open Authentication (OATH)
Open Authentication (OATH) is designed to facilitate sharing of information (resources) within a user profile between sites.
Capture the Flag (CTF)
Capture the Flag (CTF) is usually used in ethical hacker training programs and gamified competitions
Privilege Management
Separation of duties
Job Rotation
Least Privilege
Sufficient permission to do your job
- Reduce if compromised
Identity Management
Accounts can be securely associated with a digital ID
- PKI (Certs)
- SSO
- smartcard (Token)
Vacations
Avoid Complacency
Used to check employees performance
Security Account Types:
Administrator / Root
- Change system attributes
- Disable these accounts for security
- Assign admin permission rather than group membership
Security Account Types:
Standard Users
Limited priv. No system changes Account profile Password Policy Guest Account
Security Account Types:
Security Groups
Privileges assigned through group membership/multiple group membership
Security Account Types:
Service Accounts
Created by OS or Service
Used by scheduled process of applications
No user interaction
-system - most privileged
-local service - same as a standard user
-Network services - same as a standard user
Linux uses services account to run a non-interactive process (Daemon)
Account Policies
Enforce privilege management policy as what a user can and cannot do
Account Attributes
- SID
- Acc. Name + PW
- Profile: Shares/Stores, Environment settings/identity attributes
Group Policy/Group Membership
OU - Assigns group policy
- user
- computer
- group
Password Policy
Domain Level
- Complexity
- Age
- History
- Account lockout
Account Restrictions
- location-based
- IP address
- location services: geofencing (entering or leaving an area)
Time based Restrictions
- Log on hours
- how long to access
- force log off if inactive
Account Auditing
Security and audit log
Check account activity
Detect Intrusions.
Open ID connect
- Authentication
- Trust relation using PII or user accounts
- PII (Personably Identifiable Information)
Trusts
One way A –> B
Two way A B
Transitive Trust
A –> B
B –> C
Therefore A –> C
Personnel Policies
What you can do in an agreement
- Conduct Policies
- AUP (misuse of equiptment)
- Codes of conduct
- Clean desk policy (confidential documents)
Training
Security Policies
Incident Policies (Shared documents / HDD disposal)
Password Policies
Social Engineering / malware
